19 package org.sleuthkit.datamodel;
21 import com.google.common.collect.ImmutableSet;
22 import java.sql.ResultSet;
23 import java.sql.SQLException;
24 import java.sql.Statement;
25 import java.util.ArrayList;
26 import java.util.Arrays;
27 import java.util.Collection;
28 import java.util.Collections;
29 import java.util.HashSet;
30 import java.util.List;
31 import java.util.Objects;
33 import java.util.stream.Collectors;
50 this.caseDb = Objects.requireNonNull(casedb,
"Cannot create Blackboard for null SleuthkitCase");
167 final String queryString =
"SELECT DISTINCT arts.artifact_type_id AS artifact_type_id, "
168 +
"types.type_name AS type_name, types.display_name AS display_name "
169 +
"FROM blackboard_artifact_types AS types "
170 +
"INNER JOIN blackboard_artifacts AS arts "
171 +
"ON arts.artifact_type_id = types.artifact_type_id "
172 +
"WHERE arts.data_source_obj_id = " + dataSourceObjId;
176 Statement statement = connection.createStatement();
177 ResultSet resultSet = connection.executeQuery(statement, queryString);) {
180 while (resultSet.next()) {
182 resultSet.getString(
"type_name"), resultSet.getString(
"display_name")));
184 return uniqueArtifactTypes;
185 }
catch (SQLException ex) {
186 throw new TskCoreException(
"Error getting artifact types is use for data source." + ex.getMessage(), ex);
205 return getArtifactsCountHelper(artifactTypeID,
206 "blackboard_artifacts.data_source_obj_id = '" + dataSourceObjId +
"';");
222 return caseDb.getArtifactsHelper(
"blackboard_artifacts.data_source_obj_id = " + dataSourceObjId
223 +
" AND blackboard_artifact_types.artifact_type_id = " + artifactTypeID +
";");
238 public List<BlackboardArtifact>
getArtifacts(Collection<BlackboardArtifact.Type> artifactTypes,
241 if (artifactTypes.isEmpty() || dataSourceObjIds.isEmpty()) {
242 return new ArrayList<>();
245 String typeQuery =
"";
247 if (!typeQuery.isEmpty()) {
250 typeQuery +=
"blackboard_artifact_types.artifact_type_id = " + type.getTypeID();
254 for (
long dsId : dataSourceObjIds) {
255 if (!dsQuery.isEmpty()) {
258 dsQuery +=
"blackboard_artifacts.data_source_obj_id = " + dsId;
261 String fullQuery =
"( " + typeQuery +
" ) AND ( " + dsQuery +
" );";
263 return caseDb.getArtifactsHelper(fullQuery);
278 private long getArtifactsCountHelper(
int artifactTypeID, String whereClause)
throws TskCoreException {
279 String queryString =
"SELECT COUNT(*) AS count FROM blackboard_artifacts "
280 +
"WHERE blackboard_artifacts.artifact_type_id = " + artifactTypeID
282 +
" AND " + whereClause;
286 Statement statement = connection.createStatement();
287 ResultSet resultSet = connection.executeQuery(statement, queryString);) {
290 if (resultSet.next()) {
291 count = resultSet.getLong(
"count");
294 }
catch (SQLException ex) {
295 throw new TskCoreException(
"Error getting artifact types is use for data source." + ex.getMessage(), ex);
317 ArrayList<BlackboardArtifact> artifactsList;
322 artifactsList = content.getArtifacts(artifactType);
323 if (artifactsList.isEmpty()) {
331 if (attributesMatch(artifact.getAttributes(), attributesList)) {
357 private boolean attributesMatch(Collection<BlackboardAttribute> fileAttributesList, Collection<BlackboardAttribute> expectedAttributesList) {
359 boolean match =
false;
363 if (attributeType.getTypeID() != expectedAttribute.getAttributeType().getTypeID()) {
367 Object fileAttributeValue;
368 Object expectedAttributeValue;
369 switch (attributeType.getValueType()) {
371 fileAttributeValue = fileAttribute.getValueBytes();
372 expectedAttributeValue = expectedAttribute.getValueBytes();
375 fileAttributeValue = fileAttribute.getValueDouble();
376 expectedAttributeValue = expectedAttribute.getValueDouble();
379 fileAttributeValue = fileAttribute.getValueInt();
380 expectedAttributeValue = expectedAttribute.getValueInt();
384 fileAttributeValue = fileAttribute.getValueLong();
385 expectedAttributeValue = expectedAttribute.getValueLong();
389 fileAttributeValue = fileAttribute.getValueString();
390 expectedAttributeValue = expectedAttribute.getValueString();
393 fileAttributeValue = fileAttribute.getDisplayString();
394 expectedAttributeValue = expectedAttribute.getDisplayString();
402 if (fileAttributeValue instanceof byte[]) {
403 if (Arrays.equals((byte[]) fileAttributeValue, (byte[]) expectedAttributeValue)) {
407 }
else if (fileAttributeValue.equals(expectedAttributeValue)) {
433 private static final long serialVersionUID = 1L;
452 super(message, cause);
463 private final String moduleName;
465 private final ImmutableSet<BlackboardArtifact> artifacts;
468 Set<Integer> typeIDS = artifacts.stream()
470 .collect(Collectors.toSet());
472 for (Integer typeID : typeIDS) {
479 artifactTypes = ImmutableSet.copyOf(types);
480 this.artifacts = ImmutableSet.copyOf(artifacts);
481 this.moduleName = moduleName;
490 Set<BlackboardArtifact> tempSet = artifacts.stream()
491 .filter(artifact -> artifact.getArtifactTypeID() == artifactType.getTypeID())
492 .collect(Collectors.toSet());
493 return ImmutableSet.copyOf(tempSet);
501 return artifactTypes;
List< BlackboardArtifact > getArtifacts(Collection< BlackboardArtifact.Type > artifactTypes, Collection< Long > dataSourceObjIds)
void postArtifact(BlackboardArtifact artifact, String moduleName)
void postArtifacts(Collection< BlackboardArtifact > artifacts, String moduleName)
Collection< BlackboardArtifact > getArtifacts()
Collection< BlackboardArtifact > getArtifacts(BlackboardArtifact.Type artifactType)
BlackboardAttribute.Type addArtifactAttributeType(String attrTypeString, TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
BlackboardAttribute.Type getOrAddAttributeType(String typeName, BlackboardAttribute.TSK_BLACKBOARD_ATTRIBUTE_VALUE_TYPE valueType, String displayName)
List< BlackboardArtifact > getArtifacts(int artifactTypeID, long dataSourceObjId)
TimelineManager getTimelineManager()
void releaseSingleUserCaseReadLock()
BlackboardAttribute.Type getAttributeType(String attrTypeName)
BlackboardArtifact.Type getArtifactType(String artTypeName)
boolean artifactExists(Content content, BlackboardArtifact.ARTIFACT_TYPE artifactType, Collection< BlackboardAttribute > attributesList)
Collection< BlackboardArtifact.Type > getArtifactTypes()
BlackboardArtifact.Type getOrAddArtifactType(String typeName, String displayName)
void acquireSingleUserCaseReadLock()
long getArtifactsCount(int artifactTypeID, long dataSourceObjId)
List< BlackboardArtifact.Type > getArtifactTypesInUse(long dataSourceObjId)
BlackboardArtifact.Type addBlackboardArtifactType(String artifactTypeName, String displayName)